Privacy Policy

Last updated: 11 November 2026 · Khatib Designs Ltd

This policy explains what personal data MODAX collects, what we do with it, who helps us process it, and the rights you have. It covers modax.app, the MODAX app at app.modax.app, and the MODAX API.

1. Who is responsible

Khatib Designs Ltd (Хатиб Дизайнс ООД), registered in Sofia, Bulgaria, runs MODAX. Privacy contact: hello@modax.app.

• We are the controller for data about our own customers and visitors: account and billing contacts, users’ sign-in details, website visitors and people who contact us.
• We are a processor for Customer Data: the contacts, deals, invoices, messages and other records a business puts into its workspace. That business is the controller. If your details are in a MODAX customer’s workspace, please contact that business first; we will help them respond.

2. What we collect and why

• Account data — name, work email, password (stored only as a salted hash), workspace name, role and settings. Used to create and run your account. Basis: contract.
• Billing data — Stripe handles card and payment details; we receive your name, email, billing address, tax ID if you give one, plan, seat count and payment references to manage your subscription. Basis: contract and legal obligation (tax and accounting).
• Usage and security data — IP address, device and browser, sign-in times, and an audit log of actions in your workspace. Used to keep MODAX secure, investigate problems and show you who changed what. Basis: legitimate interest.
• Contact and sales enquiries — name, email, company and message from our contact form, plus the campaign or page that brought you (for example a UTM tag). Used to reply and to understand which channels work. Basis: steps before a contract and legitimate interest.
• Website analytics — pages viewed, approximate location, device type and events like “Start free” clicks on modax.app, and on the app.modax.app sign-up page a single “signed up” event that never includes your name, email or workspace, via Google Analytics 4 with IP anonymisation. Basis: legitimate interest, or consent where required.
• Customer Data — whatever our customers choose to store, processed only to provide MODAX to them (see our Terms, section 6).

We do not sell personal data, and we do not use Customer Data to train AI models.

3. Cookies and browser storage

• modax.app uses Google Analytics cookies (_ga, _ga_*, up to 2 years) and stores your language, your approximate region (to show prices in your currency) and the campaign that brought you in your browser’s local and session storage.
• app.modax.app stores your sign-in session in your browser. It is needed for the app to work. Its sign-up page also uses the Google Analytics cookies above, under the same consent rules; no other page of the app loads analytics.

You can clear or block these in your browser. Blocking analytics does not affect the site; blocking the app’s session storage will sign you out.

Cookie settings Visitors in the EU, UK and Switzerland are asked first; analytics stays off there until they accept. You can change your choice here at any time.

4. Subprocessors

Stripe processes payment data under its privacy policy. Services a customer connects to their own workspace, such as WhatsApp or a payment gateway, are chosen and contracted by that customer. We also share data with professional advisers and with authorities where the law requires it. We will give customers notice before adding or replacing a subprocessor.

5. International transfers

MODAX’s main database is hosted in the EU. Where a provider processes data outside the EEA or your country, we rely on an adequacy decision (such as the EU–US Data Privacy Framework for certified providers) or Standard Contractual Clauses, and on the transfer safeguards required by Saudi, UAE and Kuwaiti law.

6. How long we keep data

• Account and Customer Data: for as long as the workspace is open. After a workspace is closed you can export your data for 30 days; we then delete it, and it is removed from backups within a further 60 days.
• Billing records: as long as tax and accounting law requires (in Bulgaria, generally up to 10 years).
• Contact enquiries that do not become customers: up to 24 months.
• Server and security logs: up to 12 months.
• Website analytics: no longer than 14 months.

7. Your rights

You can ask to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw consent at any time. Email hello@modax.app; we answer within one month (extendable by two months for complex requests, with notice). Workspace owners can export records from MODAX, or ask us to close and delete their workspace.

These rights come from the EU GDPR, the Saudi Personal Data Protection Law (PDPL), the UAE Federal Decree-Law No. 45 of 2021, and Kuwait’s Data Privacy Protection Regulation issued by CITRA. You can complain to Bulgaria’s Commission for Personal Data Protection (cpdp.bg) or to your local authority, such as SDAIA (Saudi Arabia), the UAE Data Office or CITRA (Kuwait).

8. Security

All traffic uses HTTPS. Each workspace’s data is isolated at the database level, passwords are hashed, and third-party keys you connect are encrypted at rest with AES-256-GCM. Staff access to production is limited to the people who run it. If a breach affects your data we will tell you, and the relevant authority, as the law requires.

9. Children

MODAX is a business tool and is not meant for anyone under 16.

10. Changes

We will post updates here and tell workspace owners about significant changes in advance.